[minglong51]

Current installed Codex 0.157.1 no longer matches the previous executable pin, and the isolated Claude 2.1.283 probe cannot use host authentication. Refresh the Codex native/companion pins and four source-derived replay records, and add an explicit Claude-only inherited Unix socket option for OAuth access tokens.

The Claude probe keeps a fresh config directory, an empty tool list and MCP configuration, subprocess scrubbing, strict receipt checks, and bounded execution. It now requests the default permission mode that the pinned provider enforces under scrubbing. Startup model and permission fields may be absent, as documented and observed; conflicting values still fail, and prompt/stop receipts must report the expected mode. The probe duplicates the caller's socket, passes only that descriptor to the child, closes its duplicate after spawning, and performs no automatic credential discovery or login.

Codex account/updated notifications are validated against the generated pinned schema at both the handshake and analysis boundaries and omitted from derived analysis/replay output. They cannot establish task binding or renew observer freshness. Raw captures remain private.

Validation:

• 258 tests pass, including descriptor isolation/cleanup, startup metadata, old-pin rejection, and freshness regression coverage.
• Four fresh Codex live probes pass: input recovery, denied permissions, denied command, and denied file change. Private source exports reproduce the committed fixture byte for byte; auth copies and denied targets are absent after cleanup.
• A fresh Claude live probe passes all three hook receipts and the exact response check, with empty stderr, closed sockets, and no access token found in its 17 generated private files.
• Provider evidence and replay artifact checks pass. Cross-model static review completed without blocking findings.

This remains Phase0 evidence: all 24 capability cells are unknown and replay records are unqualified. The OAuth descriptor contract is pinned to Claude 2.1.283. Managed live probes supply signal-driven process-group teardown; generic CLI SIGTERM/SIGHUP behavior is unchanged. No production adapter or release-version change is included.